Law360 is providing free access to its coronavirus coverage to make sure all members of the legal community have accurate information in this time of uncertainty and change. Use the form below to sign up for any of our weekly newsletters. Signing up for any of our section newsletters will opt you in to the weekly Coronavirus briefing.
Sign up for our Compliance newsletter
You must correct or enter the following before you can sign up:
Thank You!
Law360 (April 15, 2020, 5:39 PM EDT )
 |
| Robin Nagele |
 |
| Kerry Maloney |
The CARES Act allocates $200 million to help the health care industry develop greater telehealth capabilities, and directs the U.S. Department of Health and Human Services to both expand reimbursement under the Medicare program and take steps to relax regulatory barriers that have inhibited telehealth expansion. But, to take full advantage, providers need to stay on top of a number of issues that will enable them to provide services that are both legally compliant and reimbursable under federal, stateand/or commercial insurance programs.
Payment Considerations
Before launching any telehealth program, providers must consider who will pay for their services and under what conditions. For Medicare patients, the Centers for Medicare & Medicaid Services, through a growing number of Section 1135 waivers, is expanding reimbursement for services provided via telehealth technologies during the declared COVID-19 emergency.[3]
CMS's first set of telehealth waivers issued on March 30 authorized payment for professional services in a wide range of specific health care settings (some of which were not previously eligible for any form of telehealth reimbursement), including federally qualified health centers, rural health clinics, long-term care facilities, dialysis facilities and in patients' homes.
The range of providers eligible for payment (subject to state law requirements), include physicians, nurse practitioners, physician assistants, nurse midwives, certified nurse anesthetists, clinical psychologists, clinical social workers, registered dietitians and nutrition professionals.[4]
On April 9, CMS announced that it was expanding the emergency blanket waivers even further to allow additional health care services across state lines and to the maximum extent permitted by state law.[5]
The types of eligible services include evaluation and management visits, mental health counseling, and preventive health screenings. CMS will pay for three types of covered patient interactions, all of which are already authorized by Medicare in more limited circumstances:
- Medicare Telehealth Visits: An encounter between a provider and patient, either an established or a new patient, using real-time, two-way audiovisual communications equipment.[6]
- Virtual Check-In: A brief (10-15 minute) check-in between patient and provider via telephone or other communications device to decide whether an office visit or other service is needed or a remote evaluation of recorded video and/or images submitted by an established patient.
- E-Visits: A communication between a patient and provider through an online patient portal.
CMS has also waived its requirement that the practitioner be licensed in the state where the patient is located,[7] and CMS's hospital credentialing requirements, including those that are specific to telemedicine providers.[8] And, it is waiving the requirement that all patients in a hospital be under the care of an attending physician, thus allowing allied health providers to manage patients "to the fullest extent possible ... consistent with a state's emergency preparedness or pandemic plan."[9]
In a related effort to reduce barriers to care, the HHS Office of Inspector General has announced that it will not subject practitioners to OIG administrative sanctions for waiving beneficiary cost-sharing amounts for telehealth services furnished consistent with payment and coverage rules that apply during the public health emergency.[10]
The OIG has also stated that it will not view the provision of free telehealth services during this period, without more, as evidence of an inducement for referrals.[11]
The CMS and OIG waivers apply only to the Medicare program, but similar policies are being adopted under many state Medicaid programs and commercial insurance programs. Practitioners serving patients covered under these other payment programs must consult the particular payment requirements for each involved plan.
HIPAA Privacy/Security
HHS, through its Office of Civil Rights, has also expanded access to telehealth services through relaxation of Health Insurance Portability and Accountability Act privacy and security requirements to allow telemedicine providers to use less secure methods of communication, such as Skype, Apple Facetime, Facebook Messenger, Google Hangouts, Whatsapp or Zoom to reach patients.
Specifically, providers will "not be subject to penalties for violations of HIPAA Privacy, Security and Breach Notification Rules that occur in the good faith provision of telehealth during the COVID-19 nationwide public health emergency."[12] The relaxation extends to all telehealth services provided during the COVID-19 emergency, not just those covered by Medicare. This includes:
OCR's relaxation of HIPAA enforcement does not, however, extend to the privacy regulations of the federal Substance Abuse and Mental Health Services Administration set forth in Title 42 of Code of Federal Regulations Part 2, which are separate requirements.The use of electronic information and telecommunications technologies [including videoconferencing, the internet, store-and-forward imaging, streaming media, and landline and wireless communication] to support and promote long-distance clinical health care, patient and professional health-related education and public health and health administration.
OCR expects that telehealth services will continue to be provided in private settings, and when that is not possible, that providers will use reasonable HIPAA safeguards to limit incidental uses or disclosures of protected health information such as, for instance, using lowered voices, avoiding speakerphone or recommending that patients move a reasonable distance from others when discussing PHI.
OCR expects providers to notify patients of the increased risk of privacy violations when using less secure products or venues and OCR continues to prohibit the use of public-facing products, such as TikTok, Facebook Live or a Slack chatroom, because they are designed to be open to the public or allow indiscriminate access to the communication.[13]
Unlike the CMS waivers, the OCR's enforcement policy is not co-terminous with the public emergency declaration, but will continue in place until OCR decides otherwise based on facts and circumstances.
State Licensing Laws
Although CMS has waived several key provisions pertaining to practitioner licensure, credentialing and scope of practice to facilitate telehealth services to Medicare patients, providers must carefully examine parallel requirements under the state laws in which they practice and accreditation standards, which may not have been waived.
Practitioners must pay particular attention to whether they are permitted to provide telehealth services under applicable state licensure rules and whether state limitations have been waived during the COVID-19 emergency. Generally, under state law, a provider must be licensed both in the state where the patient is located and the state where the provider is located.
In many states across the country, it is easy to obtain the additional state licensure needed to provide telemedicine services, through the Interstate Medical Licensure Compact, or IMLC.[14] Neither Pennsylvania nor New Jersey, however, actively participates in the IMLC, so in those states practitioners must obtain a license using traditional means. Both states have made it easier to do so during the COVID-19 emergency.
Pennsylvania has suspended a number of requirements for out-of-state practitioners to obtain a temporary license during the COVID-19 emergency. The requirements include:
- State Board of Medicine: Several administrative requirements have been suspended to obtain a temporary license, including the requirements for letters of good standing, criminal history record checks, National Practitioner Data Bank Reports and continuing education requirements.[15]
- State Board of Osteopathic Medicine: The same administrative requirements as for the Board of Medicine are suspended, but the application process is for an unrestricted license, because there is no temporary license option.
- State Board of Nursing: Temporary permits for nurses licensed in other states can be issued immediately upon application, once licensure in the applicant's home state is verified through NURSYS. Continuing education requirements for these applicants will be waived.[16]
Although these are not specifically identified as telemedicine provisions, they facilitate the provision of telehealth services across state lines. Notably, however, Pennsylvania does not have legislation in place expressly permitting or regulating telehealth, which creates additional uncertainty for practitioners.
New Jersey, on the other hand, has a robust and expansive telehealth/telemedicine statute, which authorizes practitioners to provide telehealth services in New Jersey in any specialty area for which a license or certificate can be obtained under New Jersey law.[17] New Jersey has passed two pieces of emergency legislation that will make it easier for out-of-state practitioners to provide telehealth services to New Jersey patients.
The first is a rule modification passed in New Jersey that allows out of state-licensed health care providers to provide services within the scope of their practice to patients in New Jersey during the public health emergency. One caveat is that, unless the health care provider has a preexisting relationship with the patient that is unrelated to COVID-19, the health care services provided can only be related to services related to screening for, diagnosing, or treating COVID-19.
The second is a statute that allows expedited processing of out of state health care providers applying to become licensed in New Jersey. This allows licensed out-of-state providers to provide services to patients in New Jersey via telehealth even if they do not have a preexisting relationship. As in Pennsylvania, a number of administrative requirements are waived — such as criminal history background checks, licensing fees and provisions pertaining to minimum malpractice insurance. Individual boards are waiving additional requirements as well.[18]
In addition to the licensure requirements, providers will need to examine their state law requirements relating to credentialing, privileging, allied health practitioner scope of practice, privacy requirements and specific telehealth statutes, among others, to determine whether the activities authorized under the CMS waivers are compliant with state law requirements — either the existing law or under state-specific emergency declarations and waivers.
Likewise, accredited hospitals need to consider applicable accreditation requirements. For instance, The Joint Commission's hospital accreditation standards relating to emergency management during disasters specify that hospitals should have expedited credentialing procedures for volunteer practitioners during a period of declared emergency, but that would not appear to extend to telehealth providers who the hospital may want to engage to expand its capacity with available non-volunteer practitioners.[19]
And providers must always keep in mind that the CMS waivers extend only to Medicare patients, not patients who are insured under other governmental or commercial payment programs, each of which has its own payment rules.
The Federation of State Medical Boards has issued a state-by-state resource indicating the waivers and licensure requirements relating to COVID-19 and the Council of State Governments provides state-by-state information on executive orders pertaining to the pandemic.[20] These are both good starting places for state-specific waiver research.
In short, the capacity to provide services through telehealth is expanding rapidly to meet the demands of the COVID-19 pandemic emergency. However, careful attention not only to the federal requirements, but to state-specific regulations, accreditation standards and the mandates of individual non-Medicare payment plans is also required.
Robin Locke Nagele is a principal at Post & Schell PC and co-chair of the firm's health care practice group.
Kerry E. Maloney is a principal at the firm and former board counsel to the Pennsylvania Department of State.
The opinions expressed are those of the author(s) and do not necessarily reflect the views of the firm, its clients or Portfolio Media Inc., or any of its or their respective affiliates. This article is for general information purposes and is not intended to be and should not be taken as legal advice.
[1] Coronavirus Aid, Relief, and Economic Security Act, 116 P.L. 136, 2020 Enacted H.R. 748, 116 Enacted H.R. 748, 134 Stat. 281 (March 27, 2020).
[2] U.S. Department of Health & Human Services, Determination that a Public Health Emergency Exists (Jan. 31, 2020), available at https://www.phe.gov/emergency/news/healthactions/phe/Pages/2019-nCoV.aspx.
[3] https://www.cms.gov/newsroom/fact-sheets/medicare-telemedicine-health-care-provider-fact-sheet. The 1135 Waiver authority permits the Secretary of HHS to waive certain program requirements during a public health emergency to ensure that sufficient healthcare services and items are available to meet the needs of enrolled beneficiaries. 42 U.S.C. §1320b-5.The CMS waiver applies only to federal healthcare programs. It does not encompass Medicaid or commercial payor programs, each of which has their own rules.
[4] https://www.cms.gov/newsroom/fact-sheets/medicare-telemedicine-health-care-provider-fact-sheet (March 17, 2020).
[5] CMS News Alert April 9, 2020; https://www.cms.gov/index.php/newsroom/press-releases/cms-news-alert-april-9-2020; see, https://www.modernhealthcare.com/government/cms-allow-providers-practice-top-license-across-states?utm_source=modern-healthcare-alert&utm_medium=email&utm_campaign=20200409&utm_content=hero-readmore.
[6] CMS notes that, to the extent that the 1135 waiver requires an established relationship between the patient and provider, HHS will not audit to ensure a prior relationship for claims submitted during the Public Health Emergency. A complete list of applicable HCPCS/CPT Codes can be found at: www.cms.gov/Medicare/Medicare-General-Information/Telehealth/Telehealth-Codes.
[7] CMS, "Physicians and Other Clinicians: CMS Flexibilities to Fight COVID-19," noting that CMS has waived the licensure requirement so long as the practitioner: (i) is enrolled in Medicare, (ii) is licensed in the State that relates to his/her Medicare enrollment, (iii) is furnishing services in a State where the emergency is occurring to contribute to relief efforts there, and (iv) is not affirmatively excluded from practice in that State or any other State that is part of the 1135 emergency area.
[8] CMS, "COVID-19 Emergency Declaration Blanket Waivers for Health Care Providers," noting the blanket waiver of 42 C.F.R. § 482.22(a)(1)-(4).
[9] CMS, "Physicians and Other Clinicians: CMS Flexibilities to Fight COVID-19," noting the blanket waiver of 42 C.F.R. § 482.12(c)(1-2) and (4).
[10] OIG Policy Statement Regarding Physicians and Other Practitioners That Reduce or Waive Amounts Owed by Federal Health Care Program Beneficiaries for Telehealth Services During the 2019 Novel Coronavirus (COVID-19) Outbreak (March 17, 2020) at: https://oig.hhs.gov/fraud/docs/alertsandbulletins/2020/policy-telehealth-2020.pdf.
[11] Id. The OIG cautions that it will continue to hold practitioners accountable for (i) only billing for services performed, (ii) complying with billing, claims submission, and cost reporting requirements, and (iii) complying with all other applicable Federal, State or local statutes, rules, regulations, and ordinances. Id.
[12] OCR FAQs on Telehealth and HIPAA, https://www.hhs.gov/hipaa/for-professionals/special-topics/hipaa-covid19/index.html.
[13] OCR is responsible for HIPAA enforcement. Guidance has been issued by the Substance Abuse and Mental Health Administration (SAMHSA) for relaxation of certain privacy requirements of 42 C.F.R. Part 2 during COVID-related medical emergencies, including allowing telephonic consultations with patients without prior written consent. That guidance is available at: www.samhsa.gov/sites/default/files/covid-19-42-cfr-part-2-guidance-03192020.pdf.
[14] See, Imlcc.org. Currently 29 states plus Guam and the District of Columbia participate in this compact.
[15] The application for temporary licensure of a medical physician may be found here: https://bit.ly/2Rf3dgw.
[16] The application is at: https://www.dos.pa.gov/Documents/2020-03-18-Temporary-Licenses-Out-of-State-Practitioners.pdf.
[17] NJ Statute §45:1-61et seq.
[18] https://www.nj.gov/oag/newsreleases20/pr20200320a.html.The application is available at:https://www.njconsumeraffairs.gov/Pages/Accelerated-Temporary-Licensure.aspx.
[19] The Joint Commission, "Emergency Management – Requirements for Granting Privileges During a Disaster," https://www.jointcommission.org/standards/standard-faqs/hospital-and-hospital-clinics/emergency-management-em/000002275/ (last updated April 6, 2020). For TJC-accredited hospitals that use TJC for CMS "deemed status" purposes, it is unclear whether the CMS waivers would preempt non-conforming TJC-specific accreditation requirements, but that would seem to be a reasonable presumption.
[20] https://web.csg.org/covid19/executive-orders/.
For a reprint of this article, please contact reprints@law360.com.
